- 05 Jul, 2019 1 commit
-
-
Maya Lekova authored
Got rid of the following circular header dependency chains: compilation-dependencies <-> js-heap-broker <-> access-info types <-> js-heap-broker <-> access-info Extracted former CompilationDependencies::Dependency class into its own header. Extracted *Ref classes into their own header. This should enable building on older GCC versions, e.g. 5.4.0. Bug: v8:9440 Change-Id: Ia345bc227d8f7806d0b8622b706346a7ce6d01ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687415 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#62541}
-
- 01 Jul, 2019 1 commit
-
-
Georg Neis authored
Change its name to InferReceiverMapsUnsafe and add a comment that MapInference should be used instead in new code. There are two remaining uses (outside of MapInference) and I'm not planning to remove them. TBR: jarin@chromium.org Bug: v8:9197 Change-Id: I3c89f11bbf9b4eb3a1c6f1648c2046fe409fa830 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1680540 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#62477}
-
- 23 May, 2019 2 commits
-
-
Yang Guo authored
TBR=bmeurer@chromium.org,leszeks@chromium.org Bug: v8:9247 Change-Id: I8d14d0192ea8c705f8274e8e61a162531826edb6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624220Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Hannes Payer <hpayer@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#61769}
-
Yang Guo authored
Bug: v8:9247 Change-Id: I0023200c54fa6499ae4e2cf5e4c89407cc35f187 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624218Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#61762}
-
- 03 May, 2019 2 commits
-
-
Georg Neis authored
Bug: v8:9197 Change-Id: I7d2062d9c1000d17f7010786edfc50b5d82b1631 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1594559Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#61203}
-
Jaroslav Sevcik authored
Bug: chromium:958725 Change-Id: I02d2f3ad19fa60482f8fdd8a539205091f428b68 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1594434Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#61196}
-
- 02 May, 2019 1 commit
-
-
Georg Neis authored
Replace the unsafe function NodeProperties::HasInstanceTypeWitness with a new safe method on MapInference. Bug: v8:9197 Change-Id: I937433c7721946139dc761750ea34032e58e275c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1591612Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#61156}
-
- 12 Apr, 2019 1 commit
-
-
Georg Neis authored
Bug: v8:7790 Change-Id: I65e050929a45c3391c5c9c9b0d814ae536664cf4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564067 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#60828}
-
- 18 Mar, 2019 2 commits
-
-
Georg Neis authored
There were four places where we did essentially the same steps in order to extract the initial map for inlining a JSCreate operation. This CL creates a function on NodeProperties for this task. As a side effect, this fixes a bug in ReduceJSCreateArray, where has_initial_map could get called when it wasn't permissible to do so. Notes: For simplicity, in one or two places where we used to get the target/newtarget constants from the types we now get them from HeapConstant nodes. Cosmetic change: rename "receiver_map" to the more accurate "root_map" in JSNativeContextSpecialization::ExtractReceiverMaps. Bug: chromium:939316 Change-Id: I8fd9eb50993be3d839ab9b18eeea28184c53eabf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1528435 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#60301}
-
Jaroslav Sevcik authored
Bug: chromium:939316 Change-Id: I2a132b6cce208e110fe30de8d75743ac7534fc94 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1525942 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#60291}
-
- 25 Feb, 2019 1 commit
-
-
Georg Neis authored
This was a pair of a set of maps and their common instance type (if any), but the instance type field was only used in a printing function. Removing the whole class in favor of ZoneHandleSet<Map> means we avoid looking at the heap to determine the common instance type. Eventually we can use the broker to do this if we need to. Bug: v8:7790 Change-Id: If0cadf9b17e3b9e77cffc4f0b69e2585aff7c85c Reviewed-on: https://chromium-review.googlesource.com/c/1481214Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#59834}
-
- 08 Feb, 2019 1 commit
-
-
Matt Gardner authored
This commit allows inlining of Array#indexOf and Array#includes when the array type is polymorphic for types that are compatable for array iteration. Bug: v8:8388 Change-Id: Ib826bad857c7dfe0ee7af99bb456b50b7a8b6ef9 Reviewed-on: https://chromium-review.googlesource.com/c/1450137 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#59473}
-
- 02 Nov, 2018 1 commit
-
-
Georg Neis authored
... and use it in JSCallReducer. Bug: v8:7790 Change-Id: If8ed329fef4a4de8938a2d7009cb94c0e85242f0 Reviewed-on: https://chromium-review.googlesource.com/c/1314568Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#57214}
-
- 22 Oct, 2018 1 commit
-
-
Georg Neis authored
Bug: v8:7790 Change-Id: I1e168132f5d3c90e1a3ee5c13ebc6dbc11e9daa1 Reviewed-on: https://chromium-review.googlesource.com/c/1288250 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#56859}
-
- 18 Oct, 2018 2 commits
-
-
Benedikt Meurer authored
Teach TurboFan about the maps produced by JSPerformPromiseThen and JSCreatePromise, which yields a ~1-2% improvement on the doxbee promises benchmark by removing the redundant checks from the optimized code with promise chaining. Bug: v8:7253 Change-Id: If0edce8ba15917c1b7e76b9d06490cfffe911650 Reviewed-on: https://chromium-review.googlesource.com/c/1288639Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#56778}
-
Georg Neis authored
This lets us remove the unsafe object<T>() getter. Bug: v8:7790 Change-Id: Ie438c68d4c96f1525eee5afd252523b222dc8f53 Reviewed-on: https://chromium-review.googlesource.com/c/1288411Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#56761}
-
- 16 Oct, 2018 1 commit
-
-
Georg Neis authored
As well as a few other things in JSNativeContextSpecialization. Bug: v8:7790 Change-Id: Ic13abec45797bb4c6cc66a140180122529c7288d Reviewed-on: https://chromium-review.googlesource.com/c/1280327Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#56670}
-
- 12 Oct, 2018 1 commit
-
-
Georg Neis authored
As part of the standard objects serialization, collect the identities of the Array prototype and the Object prototype from all native contexts. This information is then be consulted at compile time instead of having to call Isolate::IsInAnyContext (which accesses the heap). Bug: v8:7790 Change-Id: I26a8271afadfce243a8032e4a012f249ce3c2a60 Reviewed-on: https://chromium-review.googlesource.com/c/1275815 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#56599}
-
- 21 Sep, 2018 1 commit
-
-
Benedikt Meurer authored
The JSToInteger operator is not used anywhere in TurboFan nowadays, so no point in keeping the dead code in the tree. Bug: v8:8015 Change-Id: If03ba63c4b932ba0aac60b9bbc89fee3909a93c6 Reviewed-on: https://chromium-review.googlesource.com/1238238Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#56126}
-
- 23 Jul, 2018 2 commits
-
-
Stephan Herhut authored
This moves the static handle() helper function to handles-inl.h as it ultimately depends on handles-inl.h anyway. To make this possible, also move some other code to -inl.h files and split up some header files into a -inl.h part. Bug: v8:7490 Change-Id: I0f68e0728ba082b87ffa911aaf205d9b1523d2c9 Reviewed-on: https://chromium-review.googlesource.com/1146723Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Stephan Herhut <herhut@chromium.org> Cr-Commit-Position: refs/heads/master@{#54617}
-
Sigurd Schneider authored
This is a reland of 9eca23e9 Adds a deopt continuation, which fixes JavaScript stack traces to contain the number constructor after inlining. Original change's description: > [turbofan] Inline Number constructor in certain cases > > This CL adds inlining for the Number constructor if new.target is not > present. The lowering is BigInt compatible, i.e. it converts BigInts to > numbers. > > Bug: v8:7904 > Change-Id: If03b9f872d82e50b6ded7709069181c33dc44e82 > Reviewed-on: https://chromium-review.googlesource.com/1118557 > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#54454} Bug: v8:7904 Change-Id: Ic416e5ba81fa3a0f59ae4afa80df83c46a759487 Reviewed-on: https://chromium-review.googlesource.com/1146581 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#54609}
-
- 19 Jul, 2018 1 commit
-
-
Sigurd Schneider authored
This reverts commit 9eca23e9. Reason for revert: Clusterfuzz correctness issue Original change's description: > [turbofan] Inline Number constructor in certain cases > > This CL adds inlining for the Number constructor if new.target is not > present. The lowering is BigInt compatible, i.e. it converts BigInts to > numbers. > > Bug: v8:7904 > Change-Id: If03b9f872d82e50b6ded7709069181c33dc44e82 > Reviewed-on: https://chromium-review.googlesource.com/1118557 > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#54454} TBR=jarin@chromium.org,neis@chromium.org,sigurds@chromium.org,bmeurer@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:7904 Change-Id: Ie5fa6c1262b8acc33edb672a0124f4458fcded86 Reviewed-on: https://chromium-review.googlesource.com/1142777Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#54544}
-
- 16 Jul, 2018 1 commit
-
-
Sigurd Schneider authored
This CL adds inlining for the Number constructor if new.target is not present. The lowering is BigInt compatible, i.e. it converts BigInts to numbers. Bug: v8:7904 Change-Id: If03b9f872d82e50b6ded7709069181c33dc44e82 Reviewed-on: https://chromium-review.googlesource.com/1118557 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#54454}
-
- 23 Jun, 2018 1 commit
-
-
Leszek Swirski authored
Access Isolate* and Heap* wherever already available. Roughly: GetIsolate(): -20 GetHeap(): -22 Handle<>(HeapObject): -315 handle(HeapObject): -21 Bug: v8:7786 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I2da36ed1909d849812a1cb6bf94cb735eedca45b Reviewed-on: https://chromium-review.googlesource.com/1111707 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#53987}
-
- 15 Jun, 2018 1 commit
-
-
Leszek Swirski authored
Bug: v8:7786 Change-Id: I1e568ff6da02dfd92b24b8badd665096cf49a13a Reviewed-on: https://chromium-review.googlesource.com/1101321Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#53747}
-
- 28 Apr, 2018 1 commit
-
-
Jaroslav Sevcik authored
This is part of the effort to decrease the amount of undefined behavior. that v8 relies on. The main change here is to represent types with class Type rather than with pointer Type*. To make the CL smaller, I used an operator overload hack to separate the change from `->` to `.`. I am working on a CL that will remove the operator and change all those arrows to dots. Bug: v8:3770 Change-Id: I71a197cb739a1467937bc95c2a757fab0469aa22 Reviewed-on: https://chromium-review.googlesource.com/1032551 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#52872}
-
- 16 Mar, 2018 1 commit
-
-
Benedikt Meurer authored
A value of type OtherSeqString can change its type to OtherNonSeqString via inplace internalization (and redirection via a ThinString). This can lead to out of bounds memory accesses and generally correctness bugs, as seen with crbug.com/822284. This change might affect performance in some cases, and we'll need to evaluate whether it's worth spending cycles on adding another mechanism that leverages the sequential string information in a safe way on a case by case basis. Bug: chromium:822284 Change-Id: I0de77ec089a774236555f38c365f7548f454edfe Reviewed-on: https://chromium-review.googlesource.com/966021Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#51975}
-
- 23 Feb, 2018 3 commits
-
-
Sigurd Schneider authored
This is a reland of 3ff4b447. Original version did not handle V8_INTL_SUPPORT. Original change's description: > [turbofan] Move String.* functions to JSCallReducer > > Bug: v8:7250, v8:7340 > Change-Id: Ibb8d5badf89c66bd9bcb6bb390256ae81d0e899c > Reviewed-on: https://chromium-review.googlesource.com/913208 > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51505} Bug: v8:7250, v8:7340 Change-Id: Id908cbcfaa9e9cf5459d6d3289e6ec00e387d287 Reviewed-on: https://chromium-review.googlesource.com/934268Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51514}
-
Sigurd Schneider authored
This reverts commit 3ff4b447. Reason for revert: Does not handle V8_INTL_SUPPORT correctly Original change's description: > [turbofan] Move String.* functions to JSCallReducer > > Bug: v8:7250, v8:7340 > Change-Id: Ibb8d5badf89c66bd9bcb6bb390256ae81d0e899c > Reviewed-on: https://chromium-review.googlesource.com/913208 > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51505} TBR=sigurds@chromium.org,bmeurer@chromium.org Change-Id: I6efb3b758b0fcadc012a90c4175de3c1ebccee95 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7250, v8:7340 Reviewed-on: https://chromium-review.googlesource.com/934267Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51507}
-
Sigurd Schneider authored
Bug: v8:7250, v8:7340 Change-Id: Ibb8d5badf89c66bd9bcb6bb390256ae81d0e899c Reviewed-on: https://chromium-review.googlesource.com/913208 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51505}
-
- 15 Jan, 2018 1 commit
-
-
Benedikt Meurer authored
For JSCreate nodes with constant inputs we cannot simply assume that the new.target input is a JSFunction, since it can essentially be any JSReceiver that is a constructor, i.e. it can also be a JSBoundFunction. Bug: chromium:801627 Change-Id: Ia37bf9c0a751e4665e1167a3771fbe166473c979 Reviewed-on: https://chromium-review.googlesource.com/866493Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#50563}
-
- 11 Jan, 2018 1 commit
-
-
Georg Neis authored
Also sort some lists to improve readability. Bug: Change-Id: I296d1706e7c568c325732e9c57622bc4de571d62 Reviewed-on: https://chromium-review.googlesource.com/859240Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#50517}
-
- 04 Jan, 2018 1 commit
-
-
Mostyn Bramley-Moore authored
Bug: v8:7127, v8:7204, v8:7205 Change-Id: Iedea388590991e4d0edcf59e02c767b6c04460e7 Reviewed-on: https://chromium-review.googlesource.com/849216Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Mostyn Bramley-Moore <mostynb@vewd.com> Cr-Commit-Position: refs/heads/master@{#50351}
-
- 27 Dec, 2017 1 commit
-
-
Caitlin Potter authored
Add an early exit if the control op is Dead to prevent failing the DCHECK. BUG=chromium:797596, v8:5940, v8:3018 R=bmeurer@chromium.org, jarin@chromium.org Change-Id: I6090380ea69c3205740b6c7a41d7c066d18d6a9f Reviewed-on: https://chromium-review.googlesource.com/844978 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#50312}
-
- 21 Dec, 2017 1 commit
-
-
Caitlin Potter authored
NodeProperties::InferReceiverMaps now traverses effect chain for Loop-EffectPhi nodes, which makes it possible to inline `iterator.next()` within a loop when the next property is loaded outside of a loop. A new helper, GetInstanceTypeWitness(), performs InferReceiverMaps() and checks that each resulting map has an identical instance type. BUG=chromium:795632, v8:5940, v8:3018 R=bmeurer@chromium.org, jarin@chromium.org Change-Id: Id2690c224668bea62dbcad62ebc2bdf7e37e80d3 Reviewed-on: https://chromium-review.googlesource.com/837484 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#50284}
-
- 29 Nov, 2017 1 commit
-
-
Benedikt Meurer authored
The two helper functions CanBePrimitive and NeedsConvertReceiver did essentially the same, just in a slightly different way, and both weren't really robust wrt. to the list of JSConstruct* and JSCreate* operators that they were handling. There's now a single helper in the NodeProperties and a couple of extra macro lists to keep this list up to date more easily. Drive-by-fix: Also moved the CanBeNullOrUndefined helper to the NodeProperties class. Bug: v8:5267, v8:7109 Change-Id: Ibbf387040e3f424ee224c53fac15c2b3207b1926 Reviewed-on: https://chromium-review.googlesource.com/793734Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49695}
-
- 03 Nov, 2017 1 commit
-
-
Benedikt Meurer authored
We don't use ICs for the Array.prototype and the Object.prototype because the runtime has to be able to intercept them properly (for the global protectors). So we better make sure that TurboFan doesn't outsmart the system by storing to elements of either prototype directly. Bug: chromium:781116 Change-Id: I0f521601ef02c1b21018abd1bf1028fd8a811e84 Reviewed-on: https://chromium-review.googlesource.com/753089 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#49101}
-
- 27 Oct, 2017 1 commit
-
-
Andreas Rossberg authored
R=titzer@chromium.org Change-Id: Ie8c361efb48b56dc65719f09dfc79d505e0f3459 Reviewed-on: https://chromium-review.googlesource.com/735610 Commit-Queue: Andreas Rossberg <rossberg@chromium.org> Reviewed-by:
Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49000}
-
- 20 Oct, 2017 1 commit
-
-
Jaroslav Sevcik authored
Bug: v8:6396 Change-Id: I73a686bc5dc4849ca3f0addca513f7a0173ce0b3 Reviewed-on: https://chromium-review.googlesource.com/730710 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48788}
-
- 19 Oct, 2017 1 commit
-
-
Jaroslav Sevcik authored
This reverts commit 71bcc1d9. Reason for revert: Regresses Octane/Box2D, among other things. Original change's description: > [turbofan] Load elimination prunes control flow based on instance type. > > Changes: > - introduce the notion of unreachable abstract states. > > - reconnect unreachables states to runtime abort in effect phis (so that > the merged states are not polluted by unreachable branches while > preserving SSA). > > - mark states with failed map checks, unreachable map guars as unreachable. > > - add instance type to AbstractMaps, only invalidate instance type on > mismatched effect merges. > > > This results in 2-3% improvement on ARES/ML steady state. > > Bug: v8:6396 > Change-Id: I35b0d4482fa400ba7ee9a754f8ef1b2663ebc7dc > Reviewed-on: https://chromium-review.googlesource.com/727761 > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#48742} TBR=jarin@chromium.org,bmeurer@chromium.org Change-Id: I6302b37dbf5ea781c64815ef1900681531ad7d71 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6396 Reviewed-on: https://chromium-review.googlesource.com/728440Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#48763}
-